Alerting based on syslog

Dear librenms community,

I have created a rule that matches port-security logs from cisco switches and alerts us via email. The issue is when i get notified i get all the Faults for all the logs from LibreNMS > Overview > Syslog as the device continuously logs until the port-security violation is cleared. I only want one log message for every interval (alert interval set to default of 5m). What happens is i get log1, log2, log3 for every Interval (5minutes) and then i get log1, log2, log3, log4, log5, log6.

Rule:

syslog.timestamp >= macros.past_5m AND syslog.program LIKE '%PORT_SECURITY-2-PSECURE%'

I have attached the rule to a template and from what i understand i need to convert this part of the template which is a for loop to just a single output but i can’t get it to work.

@if ($alert->faults)
Faults:
@foreach ($alert->faults as $key => $value)
#{{ $key }}: {{ $value['string'] }}

@endforeach
@endif

Anyone can guide me here?
Best Regards

each syslog message is treated as a new alert so i don’t think you can fix this only based on alert rules
#Does alert interval obey if the alert has been recovered?

1 Like